Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2023, 14:31

General

  • Target

    DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar

  • Size

    359KB

  • MD5

    aeff13ad45fc317d5b4ecb6cf19f6b9c

  • SHA1

    b21a0b932f17c4e111d333682d3f750199beb584

  • SHA256

    00fd2efe7e59af1a6d9909bd4acfd7e08a3f5be6f2eb2c711afd12645e8e6abb

  • SHA512

    ae8a1cc8dcf1ff9cc0851e7c29fade369a84b43372b7f32188f1d49f9ecb773b4605fc6a129bac6890da1046d8976ebff7df0607aae4c5401046f76dec0271c4

  • SSDEEP

    6144:u/9v/FFgh/rrNf1DlzpSzFqtKHd4NMTj/KuUvU0OwZYqPHLSSaJbK9ZGVZICGgnV:kCj59DJpmqtS42TrsOwuSaJWDGV4bA

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_NOTIFICACION_VINCULACION_PROCESO_ADELANTADOR_SECRETARIA_DE_SALUD_TURBO_POR_IRREGULARIDADES.rar
    1⤵
    • Modifies registry class
    PID:4476
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1900
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:4684
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1496-0-0x000001FA67340000-0x000001FA67350000-memory.dmp

      Filesize

      64KB

    • memory/1496-16-0x000001FA67440000-0x000001FA67450000-memory.dmp

      Filesize

      64KB

    • memory/1496-32-0x000001FA6F9F0000-0x000001FA6F9F1000-memory.dmp

      Filesize

      4KB

    • memory/1496-33-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-34-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-35-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-36-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-37-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-38-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-39-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-40-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-41-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-42-0x000001FA6FA20000-0x000001FA6FA21000-memory.dmp

      Filesize

      4KB

    • memory/1496-43-0x000001FA6F640000-0x000001FA6F641000-memory.dmp

      Filesize

      4KB

    • memory/1496-44-0x000001FA6F630000-0x000001FA6F631000-memory.dmp

      Filesize

      4KB

    • memory/1496-46-0x000001FA6F640000-0x000001FA6F641000-memory.dmp

      Filesize

      4KB

    • memory/1496-49-0x000001FA6F630000-0x000001FA6F631000-memory.dmp

      Filesize

      4KB

    • memory/1496-52-0x000001FA6F570000-0x000001FA6F571000-memory.dmp

      Filesize

      4KB

    • memory/1496-64-0x000001FA6F770000-0x000001FA6F771000-memory.dmp

      Filesize

      4KB

    • memory/1496-66-0x000001FA6F780000-0x000001FA6F781000-memory.dmp

      Filesize

      4KB

    • memory/1496-67-0x000001FA6F780000-0x000001FA6F781000-memory.dmp

      Filesize

      4KB

    • memory/1496-68-0x000001FA6F890000-0x000001FA6F891000-memory.dmp

      Filesize

      4KB